* [PATCH] tty: serial: fsl_lpuart: potential NULL dereference
@ 2016-12-09 22:30 Alexey Khoroshilov
2016-12-10 14:10 ` Greg Kroah-Hartman
0 siblings, 1 reply; 2+ messages in thread
From: Alexey Khoroshilov @ 2016-12-09 22:30 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby
Cc: Alexey Khoroshilov, linux-serial, linux-kernel, ldv-project
tty_port_tty_get() might return a tty which is NULL
if the port is not associated with a tty
(e.g. due to close or hangup).
But lpuart_start_rx_dma() dereferences tty without any check.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
drivers/tty/serial/fsl_lpuart.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 76103f2c4a80..9945b37c914a 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -833,9 +833,16 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
struct circ_buf *ring = &sport->rx_ring;
int ret, nent;
int bits, baud;
- struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
- struct ktermios *termios = &tty->termios;
+ struct tty_struct *tty;
+ struct ktermios *termios;
+ tty = tty_port_tty_get(&sport->port.state->port);
+ if (!tty) {
+ dev_err(sport->port.dev, "Port is not associated with a tty\n");
+ return -ENODEV;
+ }
+
+ termios = &tty->termios;
baud = tty_get_baud_rate(tty);
bits = (termios->c_cflag & CSIZE) == CS7 ? 9 : 10;
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] tty: serial: fsl_lpuart: potential NULL dereference
2016-12-09 22:30 [PATCH] tty: serial: fsl_lpuart: potential NULL dereference Alexey Khoroshilov
@ 2016-12-10 14:10 ` Greg Kroah-Hartman
0 siblings, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2016-12-10 14:10 UTC (permalink / raw)
To: Alexey Khoroshilov; +Cc: Jiri Slaby, linux-serial, linux-kernel, ldv-project
On Sat, Dec 10, 2016 at 01:30:36AM +0300, Alexey Khoroshilov wrote:
> tty_port_tty_get() might return a tty which is NULL
> if the port is not associated with a tty
> (e.g. due to close or hangup).
> But lpuart_start_rx_dma() dereferences tty without any check.
Are you sure that tty could ever be NULL here? This function is only
called in places that seem to have a valid tty, with the maybe exception
of the resume call path. Can you audit this a bit better to be sure one
way or the other please?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-12-10 14:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-12-09 22:30 [PATCH] tty: serial: fsl_lpuart: potential NULL dereference Alexey Khoroshilov
2016-12-10 14:10 ` Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).